5 ms·
The NSA advises you to turn your phone off and back on once a week
- transpute 2y agoiOS force-restart key sequence cannot be intercepted by malware, https://www.wikihow.com/Hard-Reset-an-iPhone https://www.wikihow.com/Hard-Reset-an-iPhone Apple Configurator can define WiFi SSID allowlist, so the phone will only connect to known access points. iOS Lockdown mode blocks a class of attacks and is mostly invisible to UX. It can be disabled for trusted apps and websites. Brave can disable Javascript by default, and allow on trusted sites. Since iPhones no longer power off, a faraday bag can be useful in some contexts. iVerify claims to check for malware, unclear if it's meaningful given iOS restrictions, but the app regularly reminds the user to reboot.
- orf 2y agoiVerify looks like total snake oil: > First and foremost, iVerify Basic is a security scanner that ensures you are using the iPhone's basic security features such as Face/Touch ID and Screen Lock, and are running the latest iOS version. It also runs a device scan that looks for security anomalies and notifies you if something seems out of place.
- transpute 2y agoNot much detail on their site. Do they have MDM access for logs? Too bad individuals can't self-host an OSS MDM to do forensics on their own devices. https://iverify.io/post/clipping-wings-our-analysis-of-a-pegasus-spyware-sample https://iverify.io/post/clipping-wings-our-analysis-of-a-peg... > For this analysis, we had access to the customer’s iTunes backups, crash logs, and sysdiagnose files. One of the best things about Threat Hunter is that we can gather these artifacts remotely without needing physical access to the device.
- beretguy 2y ago> iPhones no longer power off Is this true? I’m still using first se do i don’t know.
- transpute 2y agoiPhone 11 onwards, excluding all SE versions.
- trogdor 2y agoIn what sense do iPhones not power off? If you are referring to the “Findable After Power Off” functionality, that can be disabled in settings.
- transpute 2y agoIf phone should be findable when lost, the setting to continuously broadcast location needs to be enabled. If non-lost phone location should not be broadcast for a short period, it can be put into a faraday bag. https://news.ycombinator.com/item?id=40551032 https://news.ycombinator.com/item?id=40551032
- incompatible 2y agoI turn mine off each evening before I go to bed, and turn it back on some time during the next morning. Saves battery power too.
- derwiki 2y agoOut of curiosity, do you have a landline? I was alerted to a garage break-in because a push to my phone went to my watch, and then I called the police immediately.
- incompatible 2y agoNo, and I also don't have any sensors that would detect such intrusions, or anything of much value in the garage.
- RheingoldRiver 2y agoto me it's not so much intrusions but fire safety - I want a way to call 9-1-1 in the middle of the night if my smoke alarms go off
- SoftTalker 2y agoGet out of the house, then worry about calling 911. The amount of time it takes to turn your phone back on won't make any substantial difference.
- ars 2y agoYour phone must turn on a LOT faster than mine!!
- incompatible 2y agoIt's a point I suppose. I'd have to go to another room where I left the phone on the desk, hopefully not blocked by a fire, and turn it on. But I think my partner leaves her's on, so she could do it.
- aussieguy1234 2y agoWould this have anything to do with some of the exploits not persisting past reboot? Like the one I run regularly to jailbreak my PS4?
- carom 2y agoYes, persistence is an additional expense in an exploit and fairly difficult to achieve on an iPhone. The idea with rebooting is that any malware living in memory will be cleared out and the attacker will have to throw the exploit again. Throwing the exploit again carries risk in getting it burnt and iPhone exploits are in the $1m - $2m range. Given how we generally only reboot our phones for system updates, this is good practice.
- ramraj07 2y agoLike if someone is determined to spend that amount of moola to spy on you personally, you’re a different category of person than the normal joe tho?
- transpute 2y agoIf an exploit is soon to be burnt/patched anyway, it can be used less carefully before expiration.
- Red_Leaves_Flyy 2y agoHence Apple’s recent change to critical security update rollouts.
- mensetmanusman 2y agoMy iPhone keeps starting the day with a black screen. I had to learn the new reset sequence: quick volume up, quick volume down, hold power
- transpute 2y agoIf that's malware, reinstall the OS via DFU and Apple Configurator.
- khana 2y ago[dead]
- nomilk 2y agoProvided it's sound advice, I wonder if an OS setting could automate power down and back up at 3am once a week. Opt-in, preferably.
- 0xDEAFBEAD 2y agoI think a malicious rootkit could just show a fake power down / power up sequence.
- dawnerd 2y agoOr just disable it completely
- EasyMark 2y agoI suspect that maybe the most intrusive malware could prevent this or even fake it to the software, better to restart yourself
- whatindaheck 2y agoLooks like this can be done with Shortcuts.app on iOS.
- jamesponddotco 2y agoGrapheneOS[1] has that option in the security settings. I have mine set up so it automatically reboots the device if I haven't unlocked it in the last 8 hours. [1]: https://grapheneos.org/ https://grapheneos.org/
- yencabulator 2y agoThink of holding down the power key for some seconds as a Secure Attention Key that forces control of the device away from the exploit. Automatic reboot might catch some exploits, but the SAK and trusted boot after it gets (practically) all of them.
- omoikane 2y agoDirect link to the best practices document (PDF): https://s3.documentcloud.org/documents/21018353/nsa-mobile-device-best-practices.pdf https://s3.documentcloud.org/documents/21018353/nsa-mobile-d...
- wheelerwj 2y agoWhy is nobody talking about how this is four years old?
- deleted 2y ago[deleted]
- akira2501 2y agoMy advice to the NSA: Do the work of securing our telecommunications infrastructure so attacks like this aren't so laughably easy to pull off. That way I don't have to touch the light switch three times and turn my phone on and off while turning in a circle to keep the bad actors away. :|
- transpute 2y agoStep 1 would be to reverse the merger of the NSA's defensive and offensive missions, which were separate until 2016, https://fedscoop.com/nsa-reorganization-nsa21-august-2016/ https://fedscoop.com/nsa-reorganization-nsa21-august-2016/
- Citizen8396 2y agoThe threats these address have nothing to do with telco infrastructure, which the NSA does not run anyway.
- akira2501 2y agoThe infrastructure is used with impunity. At the very least you might be able to identify and at least block bad actors early.
- saagarjha 2y agoI hate lists like these. Not because they don’t contain good information. Some of these are excellent things to do regardless of your personal situation. But a lot of them make absolutely no sense for most people. Rebooting your phone periodically removes zero day attacks that don’t persist on your device through a restart. People who are at risk of that are a vanishingly small fraction of the population. Those who are targeted with such attacks are often reinfected anyways because attackers are persistent and realize they’ve lost access to the device. Nothing about this is described in the recommendations, it’s just “oh you should do this” with zero threat modeling whatsoever. Then there’s stuff like “don’t use public Wi-Fi” which has been a bogeyman for probably longer than I’ve been alive. It’s not a problem anymore. Basically everything you do these days is using HTTPS. The author of this post goes on to shill VPNs, which are often snake oil that is even worse than the problem they aim to “cure”. I have no problem with some parts of this list, including the NSA putting their name behind it. It’s good to keep your software up to date. Being cautious in unfamiliar contexts is usually a good trait to have. But when you throw in the other stuff it’s like if the NIH published a list like “oh you should exercise every day and also completely avoid shrimp”. Like yes some parts of it are good, some of this is only relevant to people who are allergic to shellfish. There’s no point, and actually I will say it’s actively harmful, to just publish stuff like this with explaining when it is applicable and the actual security it provides.
- dmix 2y ago> People who are at risk of that are a vanishingly small fraction of the population. It's probably a million dollars cheaper to buy access to a non-persistent exploit than a full one but those are probably looking for a one-off exfil anyway. And like you said they can just run it again a couple weeks later for new stuff. but regardless I think most peoples phones batteries die once a week anyway so it's not a big deal
- OutOfHere 2y ago> I think most peoples phones batteries die once a week anyway Not anyone I know. I have actually never had my phone's battery drain so much that the phone had to be shut down.
- inopinatus 2y agoUnder no circumstances use your phone to place or receive phone calls. Never send or receive email & text messages. Do not install any apps. Leave it powered off at all times. Store your phone in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying "Beware of the leopard"
- hnburnsy 2y ago>Leave it powered off at all times Powered off, how cute that you think you can actually power off your phone. >How are iPhones still findable even when turned off >https://www.xda-developers.com/iphone-findable-turned-off/ https://www.xda-developers.com/iphone-findable-turned-off/
- heinternets 2y agoThat article says it’s just a BT beacon chip left on, nothing else in the phone is on.
- incompatible 2y agoI'm wondering if airplane mode would disable that too.
- hnburnsy 2y agoThat's what they want you to belive!
- yjftsjthsd-h 2y agoSecurity is confidentiality, integrity, and availability.
- inopinatus 2y agoInsofar as modern personal communications are concerned, availability is tyranny. Being unavailable is a psychological shield.
- uuddlrlrbaba 2y agoWell try owning an iPhone 15 that keeps hanging when you access the files app. Been restarting this thing every 3 or 4 days
- salamo 2y agoNot only can you not access your files, but you are voluntarily restarting your phone. It seems pretty secure to me!
- AnonHP 2y agoI have this happening once in a while. I know you didn’t mean to single out iPhone 15, but this issue seems to occur in any device with iOS 17 (and all its minor releases till date). I have had to restart my phone several times because of the Files app not responding.
- Red_Leaves_Flyy 2y agoMight your phone be owned?
- BriggyDwiggs42 2y agoAre the people trying to hack me from the NSA, or are we worried about other bad actors?
- ejj28 2y agoDoes anyone else feel like this is basically a bunch of nonsense 'advice' designed to lull the public into a false sense of security? Especially considering this is coming from the NSA. What is any of this supposed to protect against besides potential 0days being used by governments (both foreign and domestic)? It's not like phones are generally extremely vulnerable to the extent that this is necessary, and if you're legitimately under threat of being targeted by someone with access to an arsenal like that of the NSO Group's, this is very weak advice. Not connecting to public wifi and not downloading attachments isn't going to save you when you're hit with a zero-click exploit.
- deleted 2y ago[deleted]
- bustling-noose 2y agoIf your device was compromised then a reboot will essentially not run that piece of software again (iOS) until you probably clicked that link and your device was exploited again (assuming its the same exact environment). While 'once a week' is very arbitrary, rebooting a device (especially an iPhone) will make it 'safer' than what it was before the reboot in theory at least. iOS and Android are big and all vulnerabilities aren't reported as there are many in the wild just like any software out there. Imagine you are at a cafe that had a compromised auth portal where you clicked a bunch of things and there was a payload that exploited a vulnerability and was doing something on your phone. If you rebooted, then likely it's not running again and you may not visit the cafe again either. That way a reboot likely fixed your problem. the alternative is that you wait for that vulnerability to become public, apple or google patch it and then you update it and your device reboots. This could take literally months and that payload is still active until then. I know many people who dont reboot their phones at all unless the battery is dead while updates are also not as common as people think. So many are running iOS 16 even today when their phone says update but they just ignore. When someone reads all this on HN it sounds not very smart but these lists are designed for people who have no knowledge of tech. Hence you can sell VPNs to these people as well which is where its a bit of an issue on whats right and whats just advertising and selling you stuff. So the outrage is valid but a reboot is actually more beneficial than people think it is.
- aaron695 2y ago[dead]
- more_corn 2y agoNSA don’t get to be the good guys of infosec. They’ve been the adversaries for decades fighting against good encryption, fighting against good security, illegally capturing data whenever they could. Remember the Snowden leaks? I certainly do. Now they want to pretend none of that ever happened and advise on good security. No. Let’s take it back a couple steps and have some truth and accountability first.
- thefz 2y agoThe NSA advises you to turn your phone off and back on once a week to reload the spyware they planted, in case it has crashed
- tpoacher 2y agoNext up: Google's top tips for disabling ads effectively.
- gmoore 2y agoIt's really hard to take privacy and security advice from the NSA....